Problems in inserting data using “safe way to inpu

问题:

I am trying to input data using forms into the MySQL, and also using mysql_real_escape_string for this purpose. Unfortunately I am having a problem with the output. It displays \s, or if I use stripslashes then it removes all slashes.

If I submit web's forms using backslash \ I get this output:

"web\'s forms using backslash \\"

See I got a double backslash. But if I use the stripslashes function then it removes all slashes but also removes inputed slash and the output is

"web's forms using backslash"

Here, no backslash is displayed, but there should be one backslash at the end.

The problem is that if someone uses backslash in password field and any other filed, then the backslash will be stripped or displayed twice.And also please tell me what is best for displaying output htmlentities or htmlspecialchars

回答1:

You have magic quotes turned on. You need to disable them altogether as they are not good in terms of security.

Set them to off from php.ini (preferred):

; Magic quotes
;

; Magic quotes for incoming GET/POST/Cookie data.
magic_quotes_gpc = Off

; Magic quotes for runtime-generated data, e.g. data from SQL, from exec(), etc.
magic_quotes_runtime = Off

; Use Sybase-style magic quotes (escape ' with '' instead of \').
magic_quotes_sybase = Off

Or you can disable them at runtime:

if (get_magic_quotes_gpc())
{
    $process = array(&$_GET, &$_POST, &$_COOKIE, &$_REQUEST);
    while (list($key, $val) = each($process))
    {
        foreach ($val as $k => $v)
        {
            unset($process[$key][$k]);
            if (is_array($v))
            {
                $process[$key][stripslashes($k)] = $v;
                $process[] = &$process[$key][stripslashes($k)];
            }
            else
            {
                $process[$key][stripslashes($k)] = stripslashes($v);
            }
        }
    }
    unset($process);
}

回答2:

Use the mysqli library and Prepared Statements. Then all characters go in as data and you don't need to mess with all this stuff.

What characters are NOT escaped with a mysqli prepared statement?

Why is using a mysql prepared statement more secure than using the common escape functions?

回答3:

Safe way to input data to mysql

Problems in inserting data using “safe way to input data to mysql using PHP”

You should use PDO(new improved way) prepared statement which are safer and faster then there predecessors(mysql_real_escape_string, etc). Why you Should be using PHP’s PDO for Database Access goes into deeper details.

Displaying output

The problem is that if someone uses backslash in password field and any other filed, then the backslash will be stripped or displayed twice.And also please tell me what is best for displaying output htmlentities or htmlspecialchars.

The new and improved way is to use filter. In particular I would advise you to read all these Performance and Security slides from PHP creator Rasmus Ledorf. http://talks.php.net/ has a lot of good slides in general which you should have a look at.